pentest-agents
starsforks
How to install pentest-agents?
h-mmer/pentest-agents
$git clone https://github.com/H-mmer/pentest-agents---
README.md
| 1 | <p align="center"> |
| 2 | <img src="docs/assets/logo.svg" alt="Pentest Agent Suite" width="440"/> |
| 3 | </p> |
| 4 | |
| 5 | <h1 align="center">Pentest Agent Suite for Claude Code</h1> |
| 6 | |
| 7 | <p align="center"> |
| 8 | <em>Autonomous bug-bounty framework for Claude Code and 6 other AI coding tools — 50 agents, 26 commands, 19 CLI tools, 11 skills, 2 MCP servers.</em> |
| 9 | </p> |
| 10 | |
| 11 | <p align="center"> |
| 12 | <img src="https://img.shields.io/badge/python-3.10%2B-blue?logo=python&logoColor=white" alt="Python 3.10+"/> |
| 13 | <img src="https://img.shields.io/badge/Claude-Code-d97757" alt="Claude Code"/> |
| 14 | <img src="https://img.shields.io/badge/MCP-servers%20%C3%97%202-2ea043" alt="MCP servers"/> |
| 15 | <img src="https://img.shields.io/badge/agents-50-8957e5" alt="50 agents"/> |
| 16 | <img src="https://img.shields.io/badge/payloads-2500%20lines-f85149" alt="Payloads"/> |
| 17 | <img src="https://img.shields.io/badge/IDEs-7-1f6feb" alt="7 IDE targets"/> |
| 18 | </p> |
| 19 | |
| 20 | --- |
| 21 | |
| 22 | **~760 files · ~118k lines · 50 agents · 26 commands · 19 CLI tools · 11 skills · 2 MCP servers (16 bug-bounty platforms + BYO writeup search) · 2,500 payload lines** |
| 23 | |
| 24 | A complete bug bounty framework. Battle-tested hunting methodology with concrete payloads, 7-Question Gate validation, autonomous hunt loops, A→B exploit chain building, persistent brain with endpoint tracking, optional semantic writeup search (bring your own index), automatic cost tracking via CC hooks, live platform integration, and a cross-IDE installer that emits the native format for Claude Code, Codex, Gemini, Cursor, Windsurf, VS Code Copilot, and OpenClaw. |
| 25 | |
| 26 | ## Quick Start |
| 27 | |
| 28 | ```bash |
| 29 | # MCP servers are launched via `uv run --with mcp` — no global pip install required. |
| 30 | export HACKERONE_USERNAME=you HACKERONE_TOKEN=your_token |
| 31 | uv run python3 tools/scaffold.py hackerone tesla |
| 32 | cd ~/bounties/hackerone-tesla && claude |
| 33 | /model opus # Opus 4.7 [1M] — subagents inherit via model: "inherit" |
| 34 | /sync hackerone tesla |
| 35 | /brain init && /status |
| 36 | /hunt tesla.com |
| 37 | ``` |
| 38 | |
| 39 | `scaffold.py` provisions the workspace for every supported project-scoped |
| 40 | client, not only Claude Code: `CLAUDE.md`, `AGENTS.md`, `.codex/`, |
| 41 | `.agents/skills/`, `.gemini/`, `.cursor/`, `.windsurf/`, `.github/`, and |
| 42 | `.vscode/mcp.json` are generated from the copied workspace assets so paths |
| 43 | resolve inside the bounty workspace. |
| 44 | |
| 45 | ## Install (Claude Code + 6 other AI coding tools) |
| 46 | |
| 47 | The framework ships pre-rendered for every supported tool. There are two ways |
| 48 | to use it: |
| 49 | |
| 50 | **1. Use the bundles directly (no install step)** |
| 51 | |
| 52 | ```bash |
| 53 | git clone https://github.com/H-mmer/pentest-agents-suite |
| 54 | cd pentest-agents-suite/pentest-agents/providers/codex |
| 55 | codex # or: cd ../gemini && gemini, etc. |
| 56 | ``` |
| 57 | |
| 58 | The `providers/<id>/` tree contains a fully-translated, ready-to-use bundle |
| 59 | for each non-Claude target. Path references inside use `..` to reach the |
| 60 | repo's `tools/`, `rules/`, and `mcp-*-server/` — so the bundle works as |
| 61 | long as it stays inside the cloned repo. |
| 62 | |
| 63 | **2. Run the installer (writes into your own project or `~/.codex/` etc.)** |
| 64 | |
| 65 | ```bash |
| 66 | python3 -m tools.installer install --targets all --scope project |
| 67 | python3 -m tools.installer install --targets codex --scope global |
| 68 | ``` |
| 69 | |
| 70 | Install mode rewrites paths to absolute references back into the cloned |
| 71 | pentest-agents repo, so the install works no matter where the user's own |
| 72 | project lives. |
| 73 | |
| 74 | | Target | Agents | Slash commands | Rules | MCP | Scopes | |
| 75 | |---|---|---|---|---|---| |
| 76 | | **Claude Code** | native `.claude/agents/*.md` | `.claude/skills/<name>/SKILL.md` | `CLAUDE.md` | `.mcp.json` / `~/.claude.json` | global + project | |
| 77 | | **OpenAI Codex** | native `.codex/agents/*.toml` | `.agents/skills/<name>/SKILL.md` | `AGENTS.md` (≤32 KiB) | `[mcp_servers.*]` in `config.toml` | global + project | |
| 78 | | **Google Gemini** | native `.gemini/agents/*.md` | TOML in `.gemini/commands/` | `GEMINI.md` | `mcpServers` in `settings.json` | global + project | |
| 79 | | **Cursor** | → skills `.cursor/skills/agent-*/SKILL.md` (no native subagents) | → skills `.cursor/skills/cmd-*/SKILL.md` | `.cursor/rules/*.mdc` + `AGEN |
People who liked this also viewed
6 picksType
- mcp-scannerScan MCP servers for potential threats & security findings.MCP ServersJul 2026
- hol-guardOpen-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, MCP servers, plugins, and skills at runtime.MCP ServersJul 2026
- agent-scanSecurity scanner for AI agents, MCP servers and agent skills.MCP ServersJul 2026
- falcon-mcpConnect AI agents to CrowdStrike Falcon for automated security analysis and threat huntingMCP ServersJul 2026
- python🔐 Plug-and-play auth for Python MCP servers.MCP ServersAug 2025
- auth0-mcp-serverConnect LLMs and AI agents to Auth0 Management APIs via an MCP server. Use natural-language commands to create apps, deploy Actions, and query logs—runs locally and supports interactive tenant authentication for secure Auth0 administration from AI tools/CLIs.MCP ServersJul 2026
